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In this letter we introduce the problem of secrecy reversibility. This asks when two honest parties 
can distill secret bits from some tripartite distribution Pxyz and transform secret bits back into 
Pxyz at equal rates using local operation and public communication (LOPC). This is the classical 
analog to the well-studied problem of reversibly concentrating and diluting entanglement in a quan¬ 
tum state. We identify the structure of distributions possessing reversible secrecy when one of the 
honest parties holds a binary distribution, and it is possible that all reversible distributions have this 
form. These distributions are more general than what is obtained by simply constructing a classical 
analog to the family of quantum states known to have reversible entanglement. An indispensable 
tool used in our analysis is a conditional form of the Gacs-Korner common information. 


Resource theories offer a powerful framework for study¬ 
ing what physical processes are possible under a cer¬ 
tain class of constraints. For instance, when studying 
the manipulation of quantum systems, entanglement is 
identified as a precious resource that cannot be freely 
generated under local quantum operations and classical 
communication (LOCC). Inspired by the conceptual suc¬ 
cesses of entanglement theory, researchers have recently 
begun applying a resource-theoretic perspective toward 
the notion of secrecy in classical information theory mi. 
For two-party secrecy, one considers tripartite distribu¬ 
tions pxyz'- Alice ( X ) and Bob (F) share correlations 
about which, undesirably, Eve ( Z ) has side information. 
The distributions are manipulated using local operations 
and public communication (LOPC), which is the classical 
analog of LOCC. Just as the ebit |<I>) = 1/2(|00)-F|11)) 

represents a fundamental unit of entanglement, a secret 
bit <&xy • qz represents a fundamental unit of secrecy. 
Here, $xy(i, j) = (1/2 )5ij is a perfectly correlated bit 
while qz is an arbitrary and uncorrelated distribution. 

Quantum entanglement and classical secrecy share 
many striking similarities \M- One important similar¬ 
ity lies in the tasks of resource distillation and resource 
cost. For a bipartite quantum state pab, its distillable 
entanglement Ed (pab) quantifies, roughly speaking, the 
amount of ebits that can be distilled from pab using 
LOCC [ID] (in the many-copy sense), while its entangle¬ 
ment cost Ec(pab) quantifies the amount of ebits re¬ 
quired to generate pab using LOCC m- For a dis¬ 
tribution pxyz-, its “secrecy content” can analogously 
be quantified in terms of its distillable key Kd(pxyz) 
mug and its key cost Kc(pxyz) [ID- Here, the dis¬ 
tillation goal is to obtain secret bits $xy from Pxyz, 
while the formation goal is simulate pxyz using <$>xy 
and public communication. Compared to entanglement 
theory, much less is known about the relationship be¬ 
tween Kd and Kc, except for the expected hierarchy 

Kc > Kd [S.- 


With the inequality Kq > K D , classical secrecy can 
be given a thermodynamic interpretation similar to en¬ 
tanglement na ng. By the second law of thermody¬ 
namics, a heat engine cannot do more work when trans¬ 
ferring heat from one temperature bath to a lower one 
than the work required to perform the reverse refrigera¬ 
tion process. Likewise, Kq(pxyz) > Kd(pxyz) means 
that an LOPC protocol is not able to distill more se¬ 
cret bits from pxyz than the secret bits needed to per¬ 
form the reverse formation process. Any distribution for 
which this inequality is tight can thus be regarded as 
the secrecy analog of a reversible heat engine. The se¬ 
crecy reversibility problem asks what distributions satisfy 
K c (pxyz) = K d (pxyz)■ 

To begin tackling this problem, it is instructive to first 
consider the quantum scenario. It is well-known that all 
bipartite quantum pure states demonstrate entanglement 
reversibility: any pure state can be concentrated into an 
EPR state |$) and diluted back to the original state at 
equal rates m- Thus, a natural starting place to find 
reversible secrecy is with a classical analog to quantum 
pure states. Collins and Popescu have investigated [Tj 
one such analog based on an embedding of p(x, y, z) into 
a tripartite quantum state given by 

\^)abe = ^p(x,y,z)\xyz). (1) 

x,y,z 

If Alice and Bob’s reduced state in Iff 1 ) is pure, 
then |$) can always be expressed as Ilk) = 
Vpti)<l{ z )\ a jl3j}\ z ), where \aj) and |/3,-) are 
Schmidt basis vectors. With this motivation, Collins 
and Popescu have proposed distributions of the form 
p(x,y,z) = S xy p(x)q(z ) to be the classical analog to 
quantum pure states (another type of analog has also 
been proposed in the literature |3S]). Actually, we can 
generalize the Collins-Popescu class of distributions to 
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include distributions of the form 

P(x,y,z) =^2p(x\j)p(y\j)p(j)q(z), (2) 

3 

where p(x\j)p(x\j') = p(y\j)p(y\j') = 0 if j ^ f. 
A quantum embedding of any such distribution a la 
Eq. 0 recovers a pure state for Alice and Bob with 
Schmidt basis vectors \af) = J2 X y/p( x \j)\ x ) and \Pj) = 
^2 \/p(y\j)\y)■ We refer to any distribution having the 
the form of Eq. 0 as secret block independent (SBI), 
and they may also be considered as a type of “classi¬ 
cal pure state.” Like the Collins-Popescu distributions, 
the theory of single-copy state transformations can be 
constructed for SBI states analogous to pure quantum 
states pp. Furthermore, just as pure quantum states 
possess reversible entanglement, SBI distributions pos¬ 
sess reversible secrecy, as will be shown below (also see 
footnote 12 in [7j). 

However, it turns out that a much richer class of distri¬ 
butions beyond SBI also demonstrate secrecy reversibil¬ 
ity. To begin studying this class, we first recall a well- 
known upper bound on Kd{pxy z) referred to as the in¬ 
trinsic information of Pxyz US- This quantity is given 

by 

I{X : Y | Z) :=min/(X : Y\Z), (3) 

where the minimization is taken over over all auxiliary 
variables Z such that XY — Z — Z forms a Markov chain 
[20] . Using the definition of key cost, Renner and Wolf 
were able to prove that Kc(pxyz) > I{X : Y f Z) [Hj . 
and thus 

Kd{pxyz) < :Y f Z) < K c {pxyz)- (4) 

Consequently, we can split the secrecy reversibility 
problem into two separate questions: (1) when does 
KcipxYz) = I(X : Y X Z)> and (2) when does 
Kd\pxyz) = I(X : Y ! Z)7 We answer the first 
question below and reference certain results from Ref. 
m where we have recently studied the second question. 
However, before doing so, we introduce a variety of distri¬ 
bution classes based on the notion of a conditional com¬ 
mon function since these classes will play a central role 
in our analysis of reversible secrecy. 

Common Functions and UBI-PDf Distributions. For dis¬ 
tribution pxy , a maximal common function is a variable 
Jxy such that 

H(J xy ) = rna x{H(K) : 0 = H(K\X) = H(K\Y)}. (5) 

The value H(Jxy) has been identified by Gacs and 
Korner as the common information between X and Y 
122] . It can be shown that for every pxY: the variable 
Jxy is unique up to a relabeling of its range (see Sup¬ 
plemental Material). Note that an SBI distribution can 


be equivalently characterized by the entropic condition 
I(X : Y\Jxy) — 0, and H(Jxy) = I(X : Y) for these 
distributions [22] , 

For a tripartite distribution pxyz > we will denote a 
maximal common function of the conditional distribu¬ 
tion Pxy\z=z by Jxy\z=z- Then, a maximal conditional 
common function Jxy\z is just a collection of maxi¬ 
mal common functions {Jxy\z—z ’■ p{ z ) > 0}- Again, 
the variable Jxy\z is unique up to relabeling. We say 
that a distribution pxyz is block independent (BI) if 
I(X : Y\J xy \zZ) = 0; equivalently, if the distribution 
decomposes as 

p{x,y,z) = E E P(x\z,j)p(y\z,j)p(j,z), (6) 

z£Z JXY\Z = z=j 

where p(x\z,j)p(x\z,j') = 0 and p{y\z,j)p(y\z,j') = 0 
for j j' . Obviously SBI distributions are simply BI 
with an uncorrelated Eve. A distribution is said to be 
uniform block independent (UBI) if it is block indepen¬ 
dent, and there exist local coarse-graining maps Kx (X) 
and Ky(Y) such that Pr[J X Y\z = Kx = Ky] = 1 for 
some maximal common function Jxyiz- In other words, 
Alice and Bob can determine the value for J\y\z simply 
by consulting their local variable. With many copies of a 
UBI distribution, secret key can be distilled via privacy 
amplification at an optimal rate H(Jxy\z\Z ) = I{X : 

y\z) nacsi. 

However, in general Jxy\z will be unknown to Alice 
and Bob unless they engage in public communication. 
A public communication protocol is a sequence of pub¬ 
lic messages M = (Mi,M 2 ,--- ,M r ) such that Mk is a 
function of both M/ C _i • • ■ M-\ and X (resp. Y) when 
k is odd (resp. even). At the end of these exchanges, 
the new object of interest becomes Jxy\zmi which is a 
maximal conditional common function for the distribu¬ 
tion P(xm)(ym)(zm)- It can easily be proven that when 
Pxyz is BI, so is P(mx){my){zm), an d furthermore 

I{X : Y\ZM) = I{X : Y\Z) - I(M : J X y\z\Z) (7) 

(see Supplemental Material). This equation formalizes 
the intuitive idea that messages M will decrease Alice 
and Bob’s average conditional common information un¬ 
less, from Eve’s perspective, the messages are indepen¬ 
dent of JxY\Z- 

With this motivation, we say pxyz is uniform block 
independent under public discussion (UBI-PD) if it is 
BI and there is a public communication protocol gen¬ 
erating messages M such that P(mx)(my)(zm) is UBI 
and I(M : Jxy\z\Z) = 0. Thus, UBI-PD distribu¬ 
tions have a distillation rate of H{Jxy\zm\ZM), which 
by Eq. 0 is equal to H(J X y\z\Z) = I{X : Y\Z). 
We say a distribution belongs to the class UBI-PD! 
if there exists a channel Z\Z such that P X y\z i s UBI 
with the required public communication M also satisfy¬ 
ing I(Z : J xy ^\MZ) = 0. This latter condition assures 
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i-e. Pxv|z( 2 , 2|1) — 


The first inequality follows from the fact that I(Y : 
W\XZ) > 0 with equality obtained iff W — XZ — Y ; 
the second inequality is the data-processing inequal¬ 
ity applied to X — WZ — Y with equality obtained iff 
X — YZ — W; and the third inequality follows from the 
definition of intrinsic information. 

For the equality conditions, consider when X—YZ—W 
and Y — XZ — W. This so-called “conditional dou¬ 
ble Markov chain” can only be satisfied if I(XY : 
W\J X y\zZ) = 0 (see Supplemental Material). Using this 
we upper bound the key cost by 


FIG. 1. A UBI-PD). distribution where pz( 0) = 1/5, pz( 1) = 
4/5 and Z is a full coarse-graining of Z. In this simplified 
example, no communication is needed for Alice and Bob to 
both generate J X y\z- Note that pxyz itself is not BI. 

that K d (pxyz) = H(J xy[ z\Z) = I(X : Y ) Z). In¬ 
deed, for every UBI-PB) distribution, J xy becomes 
shared randomness under communication M. Thus, an 
achievable key rate is 

H{Jxy\z\ZM) = H (J X y\z\Z M) = H(J X yjz\Z), 

where the first equality follows from I(Z : J XY ^\MZ) = 
0 and the second from I(M : J XY \z\Z) = 0. Fig. Jlj de¬ 
picts a UBI-PD! distribution. We encourage the reader 
to visit the Supplemental Material for a comparative pic¬ 
ture of the various distribution classes identified here. 

When does Kc(pxyz ) = I(X : Y ) Z)? This question 
can be answered using the formula for key cost as com¬ 
puted by Winter, a significant result on its own since no 
single-letter expression is known for Kd{pxyz)- 

Lemma 1 (Winter (23]). For a distribution p XY z, 

Kcipxvz ) = min I(XY : W\Z), (8) 

where the minimization is over all auxiliary variables W 
and Z which satisfy XY — Z — Z and X — WZ — Y. 

Our task will now be to reproduce Renner and Wolf’s 
result that I\c(pxyz ) > I{X : Y l Z) directly from 
Winter’s formula ([8]). In doing so, we will obtain a struc¬ 
ture condition for when Kc{pxyz ) = I(X : Y ) Z). 

Lemma 2. For the distribution Pxyzi KcXpxyz ) > 
I(X :Y 4 , Z). Equality is obtained iff P XY ~z is BI, where 
Z\Z is the minimizer in I(X : Y f Z). When equality 
holds , K c (pxyz) = I{X :Y l Z) = H{J XY{S \Z). 

Proof. Let XYZWZ satisfy the minimization in Eq. ([8]) . 
Then we have the following chain of inequalities: 

KciPxYz) = I(XY : W\Z) > I(X : W\Z) 

>I{X:Y\Z)>I{X:YIZ). (9) 


I(XY :W\Z) = I{XYJ xy[ z : W\Z) 

= I(Jxy\z • W\Z) < H(J xy \z\Z). (10) 

Since Jxy\z is both a function of X and Y given Z, it 
is easy to show H{J XY ^\Z) < I(X : Y\Z), with equal¬ 
ity iff I(X : Y\ZJ XY yz) = 0. Hence demanding that 
I(XY : W\Z) = I(X : Y\Z) gives the necessary condi¬ 
tions H(.J xy[ z\WZ) = 0 and I{X-Y\J xy ^Z) = 0. 

Conversely, if P XYZ is block independent and I(X : 
Y l Z) = I(X : Y\Z), then choose Z and W = J XY \ Z 
in the minimization of Eq. ([8]) to obtain Kc(pxyz) = 
I{X : Y 4- Z). □ 

A Class of Reversible Distributions. We have seen that 
Kd(pxyz) = I(X : Y l Z) for UBI-PD), distributions. 
Since these distributions admit a channel Z\Z with 
being BI, Lemma ! gives that K D (p XY z) = K c {pxyz ) 
for every UBI-PDJ, distribution. We have thus identi¬ 
fied a family of distributions possessing reversible secrecy, 
and we conjecture that this family completely charac¬ 
terizes secrecy reversibility in the classical setting. The 
conjecture obviously holds true for any distribution with 
0 = K c {pxyz ) = K D (p XY z) since K c (pxyz) = 0 im¬ 
plies I(X : Y f Z) = 0 by Lemma[2j and any distribution 
satisfying the latter condition is UBI-PB), by definition. 
The conjecture can also be shown as true for distributions 
satisfying min{|A?|, IJ 7 !} = 2. 

Theorem 1. If min{| X\, |^|} = 2, then Kc(pxyz) = 
K d {pxyz) iff Pxyz is UBI-PDf. 

Proof. Here we prove the theorem for when \X\ = jV = 
2, and the more general case is handled in the Supple¬ 
mental Material. Crucial to our argument is a necessary 
structural condition recently proven for distributions sat¬ 
isfying K D (p XY z ) = I(X : Y\Z) [21;. 

Proposition 1 ([21]). When |X| = |U| = 2 and there 
exists a pair (x,y) such that p(x,y\zi)p(x\zo)p(y\zo) > 0 
butp{x, y\z$) = 0 for some zq, Z\ £ Z, then Kq{pxyz) < 
I{X:Y\Z). 

Continuing with the proof of Theorem[l]in the 2x2 case, 
from the previous discussion it suffices to prove necessity 
when KcipxYZ) = Kd{pxyz ) > 0. Then by Lemma 
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[2J for some Z\Z, p XY ~z mus t be block independent and 
K d {pxyz ) = I(X : Y\Zy_ However, since K D (p X YZ) < 
Kd(p XY z ) — : Y\Z), we see that Kr>{p XY ~z) = 

/(X : Y\Z). Then from Proposition [I] the structure of 
BI distributions, and the fact that H(J XY , X \Z = z) > 
0 for some z. we have that H(X\Y) = H(Y\X) = 0; 
i.e. p XY z UBI and, up to a relabeling, has the form 
p{x,y,z) = 6 xy [xq(z) + (1 - x){\ - 9(2))]. Since Z is 
obtained by processing Z , p X y~z can bave this correlated 
form only if p X yz likewise does. Thus, pxyz is UBI. □ 

Reversible Distributions Embedded in Quantum States. 
We now consider embedding reversible distributions into 
quantum states as in Eq. ([I]). In particular, we focus 
on distributions with \X\ = jk = 2 so that the corre¬ 
sponding pab '■= Tr^ is a two-qubit state. 

We can make a comparison between the secret key of 
the underlying distribution and the entanglement of the 
embedded quantum state using an analytic formula for 
the entanglement of formation /•. /. 2a . The following rel¬ 
atively straightforward calculation is carried out in the 
Supplemental Material. 

Theorem 2. For reversible Pxyz with \X\ = \y\ = 2 
and K d {pxyz ) > 0: 

XniVxvz) = Y p( 2 ) e ( 2 vp(oRMiR) 

Ef(pab) = E ^2 Y p{z)\/p{Q\z)p{1\z)^ , ( 11 ) 

where E(:r) := h{\[ 1 — \/l — a; 2 ]) is strictly convex in x 
for h{x) := —a; log a; — (1 — a;) log(l — a;). The equality 
Kd(pxyz ) = Ef(pab) holds iff H(X\Z = z) is constant 
for all z £ Z. 

It is natural to wonder whether a quantum state with 
an embedded reversible distribution will likewise possess 
reversible entanglement. However, one can already see in 
two qubits that this will not be true in general. Every 
two-qubit embedded pab with Kb(pxyz) > 0 will take 

the form p AB = E 2 Y]. : y 0 p( z ) VpU \ z )p(f \ z ) \jj) iff I • 
This is a so-called maximally-correlated state for which 
entanglement reversibility is known to be lacking when¬ 
ever pab is not pure El [22. In fact, Ef{pab) is additive 
for the states of Theorem [2] [28 : • Thus, 

Corollary 1. When \X\ = |jk| = 2, any distribution with 
nonzero reversible secrecy will have nonzero reversible en¬ 
tanglement when embedded in a quantum state iff the em¬ 
bedded state is pure. 

Returning to Reversible Entanglement. We motivated 
our investigation into reversible secrecy by considering 
reversible entanglement in quantum pure states and ask¬ 
ing for a classical analog. This led to the proposal of SBI 
distributions as being a type of “classical pure state.” 


Beyond pure states, the only known quantum mixed 
states demonstrating entanglement reversibility are the 
so-called locally-flagged states [26j J27j [29[ [HD] ■ By gen¬ 
eralizing the type of states presented in [2D], we say that 
(tab is an LOCC-flagged state if there exists an LOCC 
instrument {C m ) m (i.e. a collection of CP maps gener¬ 
ated by an LOCC protocol E2), with to enumerating the 
different possible public messages of the protocol, such 
that (i) a = E,n' C ™( cr ) and ( Ji ) = \Vm)(Vm\ 

is pure, where p(m) = ||£ m (cr)||i. For such states, 

E c (a) = E D (a) = E,„P( m )' S ( Tr A \Pm)(Vm\)- 
What is the classical analog of LOCC-flagged mixed 
states? Care must be taken since in the definition of 
key cost, Eve must be able to use her part of pxyz to 
simulate whatever public communication Alice and Bob 
use to generate their parts of pxyz in a formation pro¬ 
tocol |14j . Given the identification of an SBI distribu¬ 
tion as a classical pure state, we say distribution pxyz 
is an LOPC-flagged state if there exists an LOPC in¬ 
strument (£ m ) m (i.e. a collection of substochastic maps 
generated by an LOPC protocol), with to enumerat¬ 
ing the different public messages of the protocol, such 
that (i) pxyz = J2m^rn(.PxYz), (h) T, m (p XY z) = 
p(x,y\m)p(z\m) is SBI, where p(m) = \\C m (pxYz)\\i, 
and (iii) p(z\m)p{z\m!) = 0 for to to'. This is for¬ 
mally analogous to the quantum scenario except for con¬ 
dition (iii), which captures the ability for Eve to repro¬ 
duce the public communication from her information Z. 
Any LOPC-flagged classical state takes the form 

p{x,y,z) = Y p(x,y\m)p(z\m)p(m) (12) 

M—m 

where M is generated by a public communication proto¬ 
col with I(X : Y\J xy \m,M ) = 0 and H{M\Z) = 0. It 
immediately follows from definition that these distribu¬ 
tions are UBI-PD, but the converse is not true. 

Conclusions. We have presented a class of distributions 
UBI-PD| that are conjectured to fully characterize re¬ 
versible secrecy. Despite the complexity of these dis¬ 
tributions, validity of this conjecture would mean that 
reversibility of some distribution could be decided by 
a single-copy analysis. Turning back to the analogous 
problem of entanglement reversibility in quantum states, 
one might then likewise hope for a solution on the single¬ 
copy level. Only LOCC-flagged mixed states are known 
to possess entanglement reversibility, and these can in¬ 
deed be identified by having a particular single-copy 
structure. We have proposed a classical analog to LOCC- 
flagged states that likewise possess reversible secrecy, but 
these do not constitute the full set of reversible states. 
Therefore, if only LOCC-flagged quantum states possess 
entanglement reversibility, then the analogous statement 
for secrecy in classical states would not be true. On 
the other hand, if entanglement and secrecy are truly 
on equal footing in terms of reversibility characters, then 
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our findings might suggest the existence of reversible en¬ 
tanglement beyond LOCC-flagged states. 

EC thanks Matthias Christandl for a helpful discussion 
on the intrinsic information and key cost. EC was sup¬ 
ported by the National Science Foundation (NSF) Early 
CAREER Award No. 1352326. MH is supported by an 
ARC Future Fellowship under Grant FT140100574. 


[1] D. Collins and S. Popescu, Phys. Rev. A 65, 032321 

( 2002 ). 

[2] K. Horodecki, M. Horodecki, P. Horodecki, and J. Op- 
penheim, Foundations of Physics 35, 2027 (2005) 

[3] N. Gisin, R. Renner, and S. Wolf, Algorithmica 34, 389 

( 2002 ) 

[4] A. Aci'n, L. Masanes, and N. Gisin, Phys. Rev. Lett. 91, 
167901 (2003). 

[5] A. Aci'n and N. Gisin, Phys. Rev. Lett. 94, 020501 (2005) 

[6] M. Christandl, A. Ekert, M. Horodecki, P. Horodecki, 
J. Oppenheim, and R. Renner, in Theory of Cryptog¬ 
raphy Lecture Notes in Computer Science, Vol. 4392, 
edited by S. Vadhan (Springer Berlin Heidelberg, 2007) 
pp. 456-478. 

[7] J. Oppenheim, R. W. Spekkens, and A. Winter, “A clas¬ 
sical analogue of negative information,” (2008), accepted 
into Phys. Rev. Lett., arXiv:quant-ph/0511247v2 

[8] J. Bae, T. Cubitt, and A. Acfn, Phys. Rev. A 79, 032304 
(2009) 

[9] M. Ozols, G. Smith, and J. A. Smolin, Phys. Rev. Lett. 
112, 110502 (2014) 

[10] E. M. Rains, Phys. Rev. A 60, 173 (1999) 

[11] P. M. Hayden, M. Horodecki, and B. M. Terhal, J. Phys. 
A: Math. Gen. 34, 6891 (2001). 

[12] R. Ahlswede and I. Csiszar, Information Theory, IEEE 
Transactions on 39, 1121 (1993) 

[13] U. Maurer, Information Theory, IEEE Transactions on 
39,733 (1993) 

[14] R. Renner and S. Wolf, in Advances in Cryptology EU¬ 
ROCRYPT 2003 ) Lecture Notes in Computer Science, 
Vol. 2656 (Springer Berlin Heidelberg, 2003) pp. 562-577. 

[15] S. Popescu and D. Rohrlich, Phys. Rev. A 56, R3319 
(1997) 

[16] M. Horodecki, J. Oppenheim, and R. Horodecki, Phys. 
Rev. Lett. 89, 240403 (2002) 

[17] C. H. Bennett, H. Bernstein, S. Popescu, and 
B. Schumacher, Phys. Rev. A 53, 2046 (1996), quant- 
ph/9511030 


[18] In Ref. 0, the authors introduce another class of dis¬ 
tributions, called bi-disjoint, which they propose as a 
different analog to quantum pure states. In terms of 
the notation used here, a distribution is bi-disjoint iff 
I(XY : Z\J( X Y)z ) = 0, where J(xy)z is the common 
information between Alice-Bob (jointly) and Eve. It is 
shown in [7] that bi-disjoint distributions behave like 
quantum pure states for the task of state merging. How¬ 
ever, in general they fail to possess reversible secrecy, nor 
do they behave like quantum pure states for single-copy 
state transformations. It therefore seems that classical 
analogies to quantum pure states can only be drawn with 
respect to specific information-theoretic tasks, a conclu¬ 
sion already implicitly acknowledged in [7]. For the task 
of resource reversibility, SBI distributions are the more 
appropriate analog to quantum pure states. 

[19] U. Maurer and S. Wolf, Information Theory, IEEE Trans¬ 
actions on 45, 499 (1999) 

[20] Recall, a triple of random variables ABC ranging over 
AxBxC form a Markov chain A—B—C iip(a\bc) = p(a\b) 
for all ( a,b,c ) £ AxBxC such that p(b, c) > 0. In 
entropic terms, this is equivalent to the vanishing of the 
conditional mutual information: I(A, C\B) = 0. 

[21] E. Chitambar, B. Fortescue, and M.-H. Hsieh, “Distri¬ 
butions attaining secret key at a rate of the conditional 
mutual information,” (2014), manuscript in preparation. 

[22] P. Gacs and J. Korner, Problems of Control and Infor¬ 
mation Theory 2, 149 (1973). 

[23] C. Bennett, G. Brassard, C. Crepeau, and U. Mau¬ 
rer, Information Theory, IEEE Transactions on 41, 1915 
(1995) 

[24] A. Winter, in Information Theory, 2005. ISIT 2005. Pro¬ 
ceedings. International Symposium on (2005) pp. 2270- 
2274. 

[25] W. K. Wootters, Phys. Rev. Lett. 80, 2245 (1998) 

[26] M. F. Cornelio, M. C. de Oliveira, and F. F. Fanchini, 
Phys. Rev. Lett. 107, 020502 (2011). 

[27] K. G. H. Vollbrecht, R. F. Werner, and M. M. Wolf, 
Phys. Rev. A 69, 062304 (2004) 

[28] G. Vidal, W. Diir, and J. I. Cirac, Phys. Rev. Lett. 89, 
027901 (2002) 

[29] P. Horodecki, R. Horodecki, and M. Horodecki, Acta 
Physica Slovaca 48, 141 (1998). 

[30] R. Horodecki, P. Horodecki, M. Horodecki, and 
K. Horodecki, Rev. Mod. Phys. 81, 865 (2009) 

[31] E. Chitambar, D. Leung, L. Maninska, M. Ozols, and 
A. Winter, Communications in Mathematical Physics 
328, 303 (2014) 

[32] I. Csiszar and J. Korner, Information Theory: Coding 
Theorems for Discrete Memoryless Systems (Cambridge 
University Press, Cambridge, UK, 2011). 


Properties of the Gacs-Korner Common Information 

In this appendix, we prove the variable Jxy that maximizes Eq. © is unique up to relabeling of its range. To 
do this we give an alternative characterization of JxYi directly reminiscent of that in [22]. Let X and Y be random 
variables over finite sets X and y respectively, with joint distribution pxy- A common partitioning of length t for 
XY are pairs of subsets ( X l , y i ) t :_ 1 such that 

(i) Xi n Xj =y i ny j = ® for »? j, 

(ii) p(X i \y j ) =p(y i \X j ) = 8ij, and 
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(iii) if (x,y) £ A 1 ; x 34 for some i, then Px(,x)py(u) > 0. 

For a given common partitioning, we refer to the subsets X\ x 34 as the “blocks” of the partitioning. The subscript 
i merely serves to label the different blocks, and for any fixed labeling, we associate a random variable J(X,Y) such 
that J(x , y) = * if (x, y ) € A) x 34- Note that each party can determine the value of J from their local information, and 
it is therefore called a common function of A' and Y |22] . A maximal common partitioning is a common partitioning 
of greatest length. 

Proposition 2. 

(a) Every pair of finite random variables XY has a unique maximal common partitioning. 

(b) Variable Jxy satisfies 

H(Jxy) = ma x{H(K) : 0 = H{K\X) = H(K\Y)} 

iff Jxy is a common function for the maximal common partitioning of XY. 

Proof, (a) Trivially X x y gives a common partitioning of length one, and any common partitioning cannot have 
length exceeding min{| A’|, |341; hence a maximal common partitioning exists. To prove uniqueness, suppose that 
(d4,34)i = i and (Xf, 340i=i are two maximal common partitionings. If they are not equivalent, then there must exist 
some subset, say X io such that X io C U^ =1 X' x in which X io n X' x 0 for A = 1, • ■ • , K > 2. Choose any such X Xq from 
this collection and define the new sets Ri 0 = X io n X' Xq and Ri 0 = X io \ X Xg , which are both nonempty since k > 2 
and the X\ are disjoint. However, we also have the properties 

x £ X io =>• p(y io \x) = 1; x G X Xg => p(y Xo |x) = 1; 

* £ Xio => pQ4, 0 1*) = 0; x?x’ Xo ^ P (y' Xa \x) = o. 

(Here we are implicitly using condition (iii) in the above definition by assuming that p(x) > 0 thereby defining 
conditional distributions). Therefore, p(Si 0 \Ri 0 ) = p(Si a \Ri 0 ) = 1 and p(Si 0 |i?i 0 ) = p(Si 0 \Ri 0 ) = 0, where 5j 0 = 34 0 H 
y Xo and S io = y io \y' Xo - A similar argument shows that p(R io \S io ) = p(R io \S io ) = 1 and p(R io \S io ) = p{R io \S io ) = 0. 
Hence, (A), 34)Lt, 0 U(^*o> ^o) U(^io> ^i 0 ) a common partitioning of length t + 1. But this is a contradiction since 
(A),34)i=i is a maximal common decomposition. 

(b) Suppose that K satisfies 0 = H(K\X) = H(K\Y) so that K = /(A) = g(Y) for some functions / and g. It 
is clear that / and g must be constant-valued for any pair of values taken from same block X, x 34 fo the maximal 
common partitioning of XY. Hence the maximum possible entropy of K is then attained iff / and g take on a different 
value for each block in this partitioning. □ 

We now turn to the conditional common information Jxy\z- We are specifically interested in the how this infor¬ 
mation evolves under LOPC for block independent distributions. The following provides a derviation of Eq. 0. 

Proposition 3. IfpxYZ is BI, then so is P(mx)(my)(zm)- Moreover, 

/( A : Y\ZM) = /(A : Y\Z) - I(M : J X y\z\Z). (13) 

Proof. For a general distribution pxyz , it is easy to see that H(K\Z) < I(X : Y\Z ) whenever H{K\XZ) = 
H(K\YZ) = 0. Equality is obtained iff Pxyz is BI, and by uniqueness of the maximal conditional common function, 
we have that K = Jxy\z up to relabeling. 

Now, suppose that pxyz is BI and Alice locally generates message Mi so that YZ — X — M\. Then 

/(A : Y\ZMr) = I(MiX : Y\Z) - I(M 1 : Y\Z) 

= I{X : Y\Z) - I (Mi : J xy \ z Y\Z) 

= I(X:Y\Z)-I(M 1 :J xy \ z \Z) 

= H(J X y\z\Z) - [ H(J X y\z\Z ) - H(J X y\z\ZMi)\ 

= H(J X y\z\ZMi). (14) 

Since H(J X y\z\XMi) = H(J xy \z\YMi) = 0, by the above discussion it follows that P(xm)(ym)(zm) is BI and 
Jxy\zMx is essentially equivalent to J X y\z] he. up to relabeling Jxy\z=z = Jxy\z=z,M 1 =m f° r all m. The third line 
of Eq. ( |14[ ) gives us the desired equality in the proposition for message Mi. Proceeding by induction proves the full 
statement for a full message M generated by an arbitrarily long communication protocol. 

P 
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A Hierarchy of Distribution Classes 


We review the various distributions classes introduced in the paper and give different examples. The hierarchy of 
the distributions is the following: 


Quantum pure- 
state analog 


Quantum LOCC- 
flagged analog 


Secret Block 
Independent 


(SBI) 


6 

O 


LOPC-flagged 


Uniform Block 

Independent 

(UBI) 


o 

o 


Reversible 

/ 

UBI-PDI 

Uniform Block (_/ 

Independent Under 
Public Discussion r\ 

(UBI-PD) V Block 

Independent 

(BI) 

\ 

Not necessarily 
reversible 


FIG. 2. A hierarchy of distribution classes and their relation to classes of reversible quantum states. 


Example Distributions: 


(a) LOPC-flagged: 

X —> 


z = 0 
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1/8 

1/8 


1 
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PXY|Z—0 
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2 
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(b) Uniform Block Independent (UBI): 
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(c) Uniform Block Independent Under Public Discussion (UBI-PD): 
X —> 
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Z = 1 
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1/2 
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(d) Block Independent (BI): 

X —* 


Z = 0 
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Z = 1 
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1 

2 

Z = 2 

0 

1 

2 

0 

1/8 

1/8 


0 

1/6 

1/6 


0 

1/2 



1 
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1/8 


1 
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FIG. 3. (a) is an LOPC-flagged distribution that is neither SBI nor UBI. (b) is likewise a UBI distribution that is neither SBI 
nor LOPC-flagged. (c) is a UBI-PD distribution that is neither UBI nor LOPC-flagged. (d) is a BI distribution that is neither 
UBI-PD nor UBI-PD4,. Figure [l] gives a UBI-PDJ. distribution that is not BI. 


























Conditional Double Markov Chain 


Proposition 4 (Conditional Double Markov Chains (also Exercise 16.25 in [32])). Random variables WXYZ satisfy 
the two Markov chains X — YZ — W and Y — XZ — W iff I(XY : W\ J X y\z%) = 0. 

Proof. If I{XY : W\ Jxy\z%) = 0 then I(Y : W\ Jxy\zZ) = 0- The Markov chain X — YZ — W follows since 

I(XY : W\J XY \ z Z) = I(X : W\YJ xy]z Z)+I(Y : W\J XY]z Z) 

= I(X : W\YZ) + I(Y : W\J XY \ Z Z), 

where we have use the fact that J XY \z is a function X and Y when given Z. A similar argument shows that 
Y — XZ - W. 

On the other hand, if the two Markov chains hold, then whenever p XY z{x, y , z) > 0, we have 

p(W = w\x, y, z) = p(w\x, z) = p{w\y, z). (15) 

Hence, the conditional distribution p(w\x,y,z) is constant across each block Xi x W in the maximal common parti¬ 
tioning of P X y\z=z‘ Consequently, 


Pw\xyz — Pw\J XY \ Z z ) 

and so for any J X y\z = j and Z = z for which p(j , z) > 0 , we have 

P{x, y, w\j, z) = p(w\x, y, j, z)p(x, y\j , z) 

= p{w\x, y, z)p(x, y\j, z) = p(w\j, z)p{x, y\j, z). (16) 

Thus, I{XY : W\ J XY \zZ) =0. □ 


Reversibility Conditions when min{|A|, |A|} = 2 

Here we generalize Theorem [ll To do so, we will need to reference a strengthened version of Proposition [l] which 
first requires some new terminology. For a distribution p, let supp[p\ denote its support; the set of elements for 
which p assigns a nonzero probability. For two distributions p XY and q X Y over X x y, we say that q XY ◄ Pxy 
if, up to a permutation between X and Y, the distributions satisfy supp[q x ] C supp\p x \ and one of the three 
additional conditions: (i) q XY is uncorrelated, (ii) supp[q Y } C supp[p Y ], or (iii) y € supp[q Y ] \ supp\p Y ] implies that 
H(XY y)-- 0. 

Lemma 3 ([21]). Let p XY z be a distribution over X x y x Z such that p XY \z= Zl ^ Pxy\z~z 0 for some zq , Zi £ Z. 
If there exists some pair ( x,y ) £ supp[p x \z=o] x supp[p Y \z=o\ f or which p{x,y\zi) > 0 but p(x,y\z 0 ) = 0, then 
Kd{pxyz ) < I(X : Y\Z). 

Using this lemma, we are able to provide a full solution to the secrecy reversibility problem when one of the parties 
has a binary random variable. 

Theorem 3. Suppose that min{|A|, |32|} = 2. Then p XY z satisfies Ko(p X Yz) = Kc(pxyz) iff Pxyz is UBI-PD. 

Proof. It suffices to prove necessity. If Kq{p XY z ) = Kz>{p XY z) then by Lemma|2j p XY z must be block independent, 
where I(X : Y f Z) = I(X : Y\Z). By the same reasoningas in Theorem 0 Kc(Pxyz ) = Kd {pxyz) implies that 
Kd(p XY z ) = I(X : Y\Z). Hence we will apply Lemma ^ on the equality Kz>{p XY z) = : Y\Z) to derive a 

necessary condition for p XY ~z- 

Without loss of generality, assume that \X\ = 2. Since P xyZ is BI, every conditional distribution Pxy\z— z either: 
(I) Uncorrelated I(X : Y\Z = z) = 0 or 
(II) Correlated and satisfying H(X\Y, Z = z) = 0. 
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Suppose now that H(X\Y = y) > 0 for some y € y, but nevertheless y is a possible event in correlated distribution 
Pxy\z=z- The latter means that p(x, y\z ) = 0 for some x € {0,1}. However, H(X\Y = y) > 0 implies the existence 
of some z ^ z such that p(x,y\z) > 0, where x = x © 1. With P X y\z=z having correlations, then supp[p x \z=;} C 
supp\p x |^=-]j and since P XY \z~ z has e hher form (I) or (II), it follows that P XY \z= z ^ Pxy\z=z • Tut then Lemma 
[ 3 ] implies that Kr)(p XY ~z) < I(X : Y\Z), which contradicts our assumption. Therefore, if y is a possible event in 
any correlated conditional distribution P XY \z — z , then H(X\Y = y) = 0. Consequently, we can define the following 
message for Bob and maximal conditional common functions: 


M{y) 


0 if H{X\Y = y) > 0 
1 if H{X\Y = y) = 0 


JXY\Zm( X i V1 Z ) TO ) 


0 if m = 0 
x if to = 1. 


Jxy\z( x ' 2/> z ) 


0 if P XY \z=z uncorrelated 
x P X y\~z=z correlated 


(17) 


It is obvious that I{J X y\z ■ M\Z) = 0 since Jxy\z = 0 for all z whenever Pxy\z=z is uncorrelated, and M = 1 for 
all z whenever p X Y\z=z is correlated. Also, Jxy\zm becomes a shared variable for Alice and Bob since it can be 
computed both by Alice and Bob given M. We thus, see that P XY z is UBI-PD. 

□ 


Calculation of Theorem [ 2 ] 

First recall that for a two-qubit state p, its concurrence is defined by C(p) = y/Xi — \/\2 — \^%s — V^ 4 , where 
the A i are the non-increasing eigenvalues of the operator pp, with p = (<72 <8> & 2 )p*(o '2 0 02 ) [2Sj - Here, p* is the 
complex conjugate of p in the computational basis, and the cq are the Pauli matrices: u\ = (° J), °2 = (° ~ 0 l ), and 
03 = (0 -1 )■ Tor a two-qubit state with concurrence C(p), its entanglement of formation is given by E (C(p)), where 
£(x) := /i(|[ 1 — y/1 — x 2 ]) and h(x) := — a; logo; — (1 — x) log(l — x). Note that E(x) is strictly convex in x. 

When \X\ = |(V| = 2, reversible distributions are UBI-PB),. If Kd{pxyz) > 0, then the distribution is UBI-PB, 
and we wish to show: 

KnipxYz) = E?( 2 ) E ( 2 Vp(0\z)p{1\z)) 

E f ( Pxy ) = E (2^2p(z)y/p(0\z)p{l\zU . (18) 

V / 

Up to a relabeling of x, a general UBI-PB distribution in 2 x 2 is given by p(x,y\z) = S xy p(x\z) for x,y £ {0,1} and 
arbitrary p(x\z). Then pab = ’^2 z p{ z )\pz){p z \, where \p z ) = Y ^ x =0 \/Pi x \ z )\ xx )■ This corresponds to a single qubit 
density matrix 


u= ( J2 zP( z )p(°\ z ) E z p( z )Vp(Q\ z MM^\ 

\Z z p( z )Vp(°\ z )p( 1 \ z ) E z p(z)p(i\ z ) ) 

_( J2 z p( z )p(^\ z ) |E z p( z )VcWz)\ 

“VIE zPi z )Vc&7) E,p(*)p(i|*) )' 

It can be seen that < 72^*02 = o’lwoq. Hence, the concurrence of pab can be computed from the eigenvalues of the 
2x2 matrix wu = woqwoq, which are 


y/p(0)p(l) ± ^2p(z)^p{0\z)p(l\z) 


The Cauchy-Schwarz Inequality then gives that 


C(pab) = max — \J Amin — 2 J2p( z )Vp(0\ z )p(M z ) = ^2p(z) c (<p z ). 


( 20 ) 
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Since Kd{pxyz) = H{J X y\z\Z) 
E(a;), we have 


p{z)E(C(ip z )), the calculation of Eq. (181. Note that by strict convexity of 


( 2 Vp(°\ z )p( 1 \ z )) = e [ 2 Y1 p( z )Vp(Q RpOM 

z£lZ \ zG2 


iff p(0\z)p(l\z) is constant for all z. This implies that H{X\Z = z) is constant for all z £ Z. 





